Malicious code in abina-amugui-anucmai (npm)

The npm package abina-amugui-anucmai was identified as part of a coordinated campaign to flood the npm registry with malicious packages. These packages are designed to exploit the tea.xyz token reward system by inflating developer reputation scores through automated package generation and publication.

The malicious payload includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute upon installation. These scripts modify the package.json manifest to remove private flags, alter version numbers, and generate random package names—primarily Indonesian-themed variants, with some English-language alternatives.

The attack vector involves continuous republication of derivative packages with randomized names to pollute the npm registry and artificially inflate reputation metrics tied to the tea protocol token reward campaign. This represents a supply chain attack targeting both the npm ecosystem integrity and the tea protocol incentive system.

The incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks such coordinated malicious package campaigns.